CVE-2026-30903

9.8 criticalEPSS 0.3%

Critical (9.8) in zoom. EPSS 0.3% chance of exploitation in the next 30 days.

External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWEs: CWE-610, CWE-73
Published: 2026-03-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zoom:workplace_desktop
zoom:workplace_virtual_desktop_infrastructure

References

https://www.zoom.com/en/trust/security-bulletin/zsb-26005

Check your stack JSON